An object of this class encapsulates a passphrase hashed using the "bigcrypt" hash function found in HP-UX, Digital Unix, OSF/1, and some other flavours of Unix. Do not confuse this with the "crypt16" found on Ultrix and Tru64 (for which see Authen::Passphrase::Crypt16). This is a subclass of Authen::Passphrase, and this document assumes that the reader is familiar with the documentation for that class.

This is a derivation of the original DES-based crypt function found on all Unices (see Authen::Passphrase::DESCrypt). The first eight bytes of the passphrase are used as a DES key to encrypt the all-bits-zero block through 25 rounds of (12-bit) salted DES, just like the original crypt. Then, if the passphrase is longer than eight bytes, the next eight bytes are used as a DES key to encrypt the all-bits-zero block through 25 rounds of salted DES, using as salt the first 12 bits of the hash of the first section. Then, if the passphrase is longer than sixteen bytes, the next eight bytes are used, with salt consisting of the first 12 bits of the hash of the second section. This repeats until the entire passphrase has been used. The hashes of all the sections are concatenated to form the final hash.

A password hash of this scheme is conventionally represented in ASCII using the base 64 encoding of the underlying DES-based crypt function. The first two characters give the salt for the first section, the next eleven give the hash of the first section, the next eleven give the hash of the second section, and so on. A hash thus encoded is used as a crypt string, on those systems where the bigcrypt algorithm is part of crypt(), but the syntax clashes with that of crypt16. This module does not treat it as a crypt string syntax.

Because the sections of the passphrase are hashed separately, it is possible to manipulate (e.g., crack) a section hash in isolation. See Authen::Passphrase::DESCrypt for handling of a single section.

Warning: This is a fatally flawed design, often providing less security than the plain DES scheme alone. Do not use seriously.

Causes salt for the first section to be generated randomly. The value given for this attribute must be 12, indicating generation of 12 bits of salt. The source of randomness may be controlled by the facility described in Data::Entropy.